Deployment of Snort IDS in SIP based Vo

Deployment of Snort IDS in SIP based Vo. IP environments Jiří Markl Jaroslav Dočkal

Motivation and targets l Evident advantages of Vo. IP l The same level of availability as in PSTN l Do. S attacks on SIP infrastructure l Attacks identification l Applicability of Snort IDS for attacks detection

Identified attacks l Attacks to SIP proxies l Common TCP/IP attacks l l l Direct attacks (Teardrop, Ping of Death, SYN Flood) Indirect attacks (Smurf attack) Other TCP floods (STREAM attack, Null flood) Distributed denial of service Attacks using specific SIP vulnerabilities Attacks to contributing services l l DNS, ENUM Application servers

SIP specific attacks l Brute force attack using Invite messages alert ip any -> $SIP_PROXY_IP $SIP_PROXY_PORTS (msg: "INVITE message flooding"; content: "INVITE"; depth: 6; threshold: type both, track by_src, count 200, seconds 60; sid: 1000100; rev: 1; ) #Suppresion of alerting for known proxy 147. 32. 121. 12 suppress gen_id 1, sig_id 1000100, track by_src, ip 147. 32. 121. 12 l Denial of service utilizing Register message

SIP specific attacks – continuation l Tearing l Bye, Cancel l Denial l down sessions of service utilizing responses 3 xx, 4 xx, 5 xx, 6 xx l Using message amplification to cause the Do. S loops l forking l

SIP specific attacks – continuation l Brute force authentication attack 401 Unauthorized l 407 Proxy Authentication Required l alert ip any -> $SIP_PROXY_IP $SIP_PROXY_PORTS (msg: "INVITE message flooding"; content: "SIP/2. 0 401 Unauthorized"; depth: 24; threshold: type both, track by_src, count 100, seconds 60; sid: 1000600; rev: 1; )

SIP specific attacks – continuation l Attacks using SQL injection l Using unresolvable DNS names alert udp $DNS_SERVERS 53 -> $SIP_PROXY_IP any msg: "DNS No such name treshold"; content: "|83|"; offset: 3; depth: 1; threshold: type both , track by_src, count 2000, seconds 60; sid: 1000400; rev: 1; )

Snort usage conclusions l Advantages l l l Based on existing Open. Source solution SIP proxy independent Can be used for detection of various attacks and known exploits – lots of rules available Can be used for detection of misconfigurations in SIP network Drawbacks l l Problems with secured connections (TLS) Usable only for simple detection

SIP rules published on Snort. org Developed rules can be obtained from Snort. org within current Community Rules set. http: //www. snort. org/pub-bin/downloads. cgi/Download/comm_rules/ Community-Rules-CURRENT. tar. gz

Thanks.